What the agent said it was doing
Every request through the gateway is a claim: this is the prompt, these are the tools, this is what I intend to do. The gateway records that claim, stamps it with a session correlation ID, and propagates the ID downstream. That ID joins the gateway record to what the app saw through RAXE Sensor [sdk] and what the host sensor observed at the kernel–one continuous timeline per agent session. When the claim and the kernel disagree, you see it.
How traffic reaches it
One base-URL change. You point your existing SDK at the gateway instead of the provider–no code rewrite, no new client library. Requests flow app → RAXE Gateway → provider, and the response comes back the same way.
# point your existing SDK at the gateway – your app code is unchanged
export ANTHROPIC_BASE_URL="https://raxe-gateway.internal.example"
# app → RAXE Gateway → provider
# claim recorded · request scored · evidence sealed – on the way throughThe request path is deliberately short: the gateway records the claim, scores it locally, and the request continues to the provider. In observe-and-log posture the verdict never gates your traffic–the score is recorded next to the request, not in front of it.
And the failure mode is honest by design: if scoring is ever unavailable, the gap is not silently swallowed–a degraded record is written so the miss itself is visible in the console.
The attack is in the arguments
Prompt-level scanning misses what hides inside tool calls. The gateway parses structured tool-use payloads and scores the arguments themselves–the SQL string, the shell command, the file path–and detects SQL injection, shell injection, and path traversal where they actually travel.
tool_use db_query
argument (sql) "SELECT * FROM users WHERE id = 1 OR 1=1; --"
signal structured tool-call risk analysis
finding sql_injection · severity HIGH
mapping MITRE ATLAS · OWASP ASI
outcome detection logged · evidence sealed · audit row writtenFive signals. One explainable verdict.
Tool-call risk is one of five signals. The gateway scores every request with the same detection stack that runs across the platform–ATLAS + ASI-mapped rules, an ML text scorer, structured tool-call risk analysis, the agent behaviour graph, and an opt-in advisory LLM judge that is evidence, never authority. Fast rules answer in single-digit milliseconds; the full multi-signal verdict lands in ~150 ms–all local.
Read the full detection stack →An audit ledger you can verify
Tamper-evident by construction
Every audit row carries a SHA-256 hash of the row before it. Change one record and the chain refuses to verify. Run the check on demand and get the answer that matters in front of an auditor: Intact.
Sealed by default
Sensitive fields stay sealed until an analyst supplies a purpose and clicks Reveal. The reveal writes its own audit row–actor, field, outcome–into the same hash-chained ledger.
Validated providers, honestly labelled
| Provider | How traffic arrives | Status |
|---|---|---|
| Anthropic | Proxy adapter–messages and structured tool use scored in the request path | Validated |
| OpenAI | Proxy adapter–messages and structured tool use scored in the request path | Validated |
| Azure OpenAI | Proxy adapter–messages and structured tool use scored in the request path | Validated |
We list what we have validated, not every logo we could draw.
Agents in AWS don't pass through your proxy. We watch them anyway.
Which agent role read that secret? CloudTrail knows. Now you do. Your agents don't stop at the model call–they assume IAM roles, read secrets and call AWS services under identities your SOC rarely watches. RAXE reads your live CloudTrail and raises detections as agent activity lands: an agent role reading a secret becomes a data-exfiltration alert in the console, on the same timeline as gateway claims and kernel-observed file access. Bedrock AgentCore telemetry joins that timeline too.
Self-hosted in your environment, watching your own AWS accounts–no vendor cloud receives your CloudTrail · Correlation, not exact attribution · Demo views use clearly-labelled sample data · Early access–design partner programme
*Absolute claims deserve footnotes: metadata telemetry details are on our trust page.
Roadmap Virtual key management · Scheduled CISO reporting · Shadow-AI discovery
Roadmap items, not shipped capability. We label the difference.